Configuring VPNs

Required. Type a name for this Phase-1 configuration. The value is a string with a maximum of 15 characters.

Type an optional description. The value is a string with a maximum of 255 characters.

Required. Select Static IP Address, Dialup user, or Dynamic DNS.

Required if you select Static IP Address. Type the IPv4 address.

Required if you select Dynamic DNS. Type the fully qualified domain name.

Required. Select an interface from the drop-down list or select any.

Required. Select Main or Aggressive for the phase-1 mode.

Required. Select Pre-shared Key or Signature for the authentication method.

If Pre-shared Key is selected, this field is required. Type a string for the pre-shared key. The key must contain at least 6 printable characters. For optimum protection against currently known attacks, the key must consist of a minimum of 16 randomly chosen alphanumeric characters.

If Pre-shared Key is selected, this field is available but optional. Enter the user group to authenticate remote VPN peers. The user group can contain local users, LDAP servers, and RADIUS servers.

If Signature is selected, this field is available but optional. Select a certificate from the drop-down list.

If Signature is selected, this field is available but optional. Select Any peer id or One peer id.

If One peer id is selected, this field is required. Enter the peer ID to uniquely identify one end of a VPN tunnel, enabling a more secure connection. If you have multiple VPN tunnels negotiating, this ensures the proper remote and local ends connect. The value is a string with a maximum of 255 characters.

Advanced...(XAUTH, NAT-traversal, DPD)

Select Specify or Main Interface IP. If you select Specify, type the IPv4 address in the field.

Select the encryption and authentication algorithms. You can select more than one. Use the arrows to move the algorithms from Available Encryption-Authentication Pair box to the Selected Encryption-Authentication Pair box.

Select one or more of the following Diffie-Hellman (DH) groups: 2, 5, 14, 15, 16, 17, 18, 19, 20, 21. At least one of the DH group settings on the remote peer or client must match one the selections on the FortiGate unit. Failure to match one or more DH groups will result in failed negotiations. Only one DH group is allowed for static and dynamic DNS gateways in aggressive mode. By default, 5 and 14 are selected.

Type the time (in seconds) that must pass before the IKE encryption key expires. When the key expires, a new key is generated without interrupting service. The key life can be from 120 to 172800 seconds. The default is 86400.

A Local ID is an alphanumeric value assigned in the Phase 1 configuration. The Local ID uniquely identifies one end of a VPN tunnel, enabling a more secure connection. If you have multiple VPN tunnels negotiating, this ensures the proper remote and local ends connect. Type a string with a maximum of 63 characters.

Select Disable or Client for the XAUTH type. The default is Disable.

Select Disable, Enable, or Forced. The default is Enable.

If NAT traversal is enabled or forced, type a keep-alive frequency setting (10-900 seconds). The default is 10. The value range is 10-900.

Required. Type a name for this Phase-2 configuration. The value is a string with a maximum of 35 characters.

Required. Select an IPSec Phase-1 configuration.

Advanced

Select the encryption and authentication algorithms. You can select more than one. Use the arrows to move the algorithms from Available Encryption-Authentication Pair box to the Selected Encryption-Authentication Pair box.

Select to enable or disable replay detection. Replay attacks occur when an unauthorized party intercepts a series of IPsec packets and replays them back into the tunnel. The default is selected.

Select to enable or disable perfect forward secrecy (PFS). Perfect forward secrecy (PFS) improves security by forcing a new Diffie-Hellman exchange whenever the key life expires. The default is selected.

Required. Select one or more of the following Diffie-Hellman (DH) groups: 2, 5, 14, 15, 16, 17, 18, 19, 20, 21. At least one of the DH group settings on the remote peer or client must match one the selections on the FortiGate unit. Failure to match one or more DH groups will result in failed negotiations. Only one DH group is allowed for static and dynamic DNS gateways in aggressive mode. By default, 5 and 14 are selected.

Required. Select the PFS key life. Select Seconds, KBytes, or Both.

• If Seconds is selected, type the number of seconds. The default is 43200. The value range is 120-172800.
• If KBytes is selected, type the number of KB. The default is 5120. The value range is 5120-4294967295.
• If Both is selected, type the number of seconds and the number of KB.

Optional. Select to enable or disable autokey keep alive. The phase 2 SA has a fixed duration. If there is traffic on the VPN as the SA nears expiry, a new SA is negotiated and the VPN switches to the new SA without interruption. If there is no traffic, the SA expires and the VPN tunnel goes down. A new SA will not be generated until there is traffic. The Autokey Keep Alive option ensures that a new SA is negotiated even if there is no traffic so that the VPN tunnel stays up. The default is deselected.

Optional. The default is deselected.

Quick Mode Selector

Select Subnet, IP Range, IP Address, or Named Address.

• If Subnet is selected, enter an IP address and netmask.
• If IP Range is selected, enter the first IP address and the last IP address in the range.
• If IP Address is selected, enter an IPv4 address.
• If Named Address is selected, select from the drop-down list.

Select Subnet, IP Range, IP Address, or Named Address.

• If Subnet is selected, enter an IP address and netmask.
• If IP Range is selected, enter the first IP address and the last IP address in the range.
• If IP Address is selected, enter an IPv4 address.
• If Named Address is selected, select from the drop-down list.

Enter the number of the local port. The default is 0 The maximum value is 65535.

Enter the number of the remote port. The default is 0 The maximum value is 65535.